When the thirteenth essay went out, I said the architecture deserved a more structured form than a series of posts allows — and that a companion reference document would follow. This is it.
Stacked Zero Trust: A Working Architecture for the Agentic Era pulls the whole argument into one place. The three-layer model, the full subject taxonomy, the maturity model with its assessment criteria and evidence indicators, the regulatory mappings, a consolidated reference list with primary sources cited in full, and a worked treatment of the Barnard Financial Group composite that ran through the series.
The essays explained the reasoning. This explains the implementation. It’s written for the practitioner who wants to apply the framework rather than read the case for it — the architect assessing a deployment, the CISO baselining maturity across an uneven estate, the advisor who wants the tools in one place.
It’s free, and it’s yours to share. No gate, no paywall. If it’s useful to someone on your team, send it on.
The document is below.
A last word. The argument doesn’t stop here. A second series is already taking shape — The Unobservable Subject — picking up where this one left off: once you accept the agent as a subject, its reasoning turns out to be the part you can’t see, even when the trace is complete. More on that before long.
Thank you for reading the series, and for the conversation around it. That’s what made this worth writing.
Colin Henderson, Edinburgh
